The primary purpose of an exposure control plan is to eliminate or minimize employee exposure to bloodborne pathogens in the workplace. This is a written document required by OSHA under the Bloodborne Pathogens Standard (29 CFR 1910.1030). Any employer with workers who could reasonably come into contact with blood or other potentially infectious materials on the job must have one. The plan lays out exactly how the workplace will prevent infections from pathogens like HIV, hepatitis B, and hepatitis C.
What the Plan Actually Covers
An exposure control plan isn’t a single policy statement. It’s a detailed operational document with several required components that work together to protect workers. At its core, the plan must include:
- Exposure determination: A list identifying which job classifications and tasks involve potential contact with blood or infectious materials.
- Methods of exposure control: The specific engineering controls, work practice controls, personal protective equipment, and housekeeping procedures the employer uses.
- Hepatitis B vaccination: How the employer will offer vaccinations to all at-risk workers.
- Post-exposure evaluation and follow-up: Step-by-step procedures for what happens after a needlestick, splash, or other exposure incident.
- Training and hazard communication: How workers will be educated about risks and protections.
- Recordkeeping: Documentation requirements, including a sharps injury log.
The plan must be accessible to employees. It’s not something that sits in an administrator’s locked filing cabinet. Workers covered by the plan have the right to review it.
How It Prevents Exposure in Practice
The plan follows a hierarchy of controls, prioritizing solutions that remove the hazard over those that rely on individual behavior. Engineering controls come first. These are physical devices or equipment changes that isolate or remove the bloodborne pathogen hazard, such as self-sheathing needles, needleless IV systems, and non-glass capillary tubes. The idea is to design the danger out of the task itself.
Work practice controls come next. These are procedures that reduce the likelihood of exposure by changing the way a task is performed. For example, prohibiting the recapping of needles by hand, requiring handwashing immediately after removing gloves, or establishing protocols for handling contaminated laundry.
Personal protective equipment (gloves, gowns, face shields, eye protection) serves as the final layer. Employers must provide all necessary PPE at no cost to the worker, and they’re responsible for cleaning, repairing, and replacing it as needed. PPE is essential, but the plan treats it as a backup to engineering and work practice controls, not a substitute.
Hepatitis B Vaccination Requirements
One of the plan’s most concrete protections is the hepatitis B vaccine. Employers must offer the full vaccination series to every worker with occupational exposure, completely free of charge. The vaccine must be offered within 10 days of a worker’s initial assignment to a role involving exposure, and it must be available at a reasonable time and place.
Workers can decline, but the employer must have them sign a declination form. If someone initially declines and later changes their mind, the employer is still required to provide the vaccine at no cost, as long as the worker remains in an exposed role. The plan must also ensure workers receive training about the vaccine’s effectiveness, safety, and benefits before they make their decision.
What Happens After an Exposure Incident
The exposure control plan must spell out exactly what happens when something goes wrong. If a worker experiences a needlestick, cut from a contaminated sharp, or splash of blood to the eyes or mouth, the employer must immediately provide a confidential medical evaluation and follow-up at no cost.
This evaluation must be performed by a licensed healthcare professional and follow current U.S. Public Health Service recommendations. It includes baseline blood testing (though the worker can consent to having blood drawn but defer HIV testing for up to 90 days while the sample is preserved), preventive treatment when medically appropriate, and counseling about the possible implications of the exposure.
The employer must provide the worker with the healthcare professional’s written opinion within 15 days of the evaluation’s completion. That opinion covers whether hepatitis B vaccination was recommended, whether the worker received it, and confirmation that the worker was informed of the evaluation results. Importantly, the plan must also include procedures for investigating the circumstances of the incident, documenting what device was involved, where it happened, and how it occurred.
The Sharps Injury Log
Employers required to maintain occupational injury and illness logs must also keep a separate sharps injury log. This log records every percutaneous injury (puncture or cut through the skin) from a contaminated sharp. Each entry must include the type and brand of the device involved, the department or work area where the injury happened, and a description of how it occurred. The log must protect the confidentiality of the injured worker, and it must be retained for the period required under OSHA’s recordkeeping standard.
This log serves a practical purpose beyond documentation. Patterns in the data, such as repeated injuries with a particular device or in a specific department, help employers identify where engineering controls need upgrading or where additional training is needed.
Training and Annual Review
The plan requires employers to train every worker with occupational exposure. Training must cover bloodborne pathogens and the diseases they cause, the methods used to control exposure, hepatitis B vaccination information, and post-exposure procedures. This training must happen when a worker is first assigned to an exposed role, at least once a year after that, and whenever new or modified tasks change a worker’s exposure risk. Workers in HIV and hepatitis B research or production facilities must receive additional specialized training on top of the standard program.
The exposure control plan itself must be reviewed and updated at least annually. This review should reflect changes in technology (particularly safer medical devices), changes in job tasks, and lessons learned from any exposure incidents during the year. It’s a living document, not a one-time compliance exercise. The annual review is where the plan’s purpose, eliminating or minimizing exposure, gets pressure-tested against what’s actually happening in the workplace.